Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.20639.13549.exe
  • Size 543KB
  • SHA256 f2912bcf7fbc7f4bce35f66e7854bf01835e74a1d5f095595eb59d4dcd7497cf
  • MD5 db92e74aee2f64a0b40a64c1a014e257
  • SHA1 fde61811f7ae53f9fa59e17fb5c2c6143a48b282
  • SHA512 37873651e05858e9e12bb3560947328fad5fa24c7c4deb07b61c4e0850998c340a5529bddd2965f3a28d124890f752adea688f2964f81f0a2153a646a99ec0b5
  • SSDEEP 12288:APuYd+V6b1momPZefI1NRtBLHVjxxFv+O+ZTWB2/XAbJK7:APuYd+V6bIomxiIhHVjHh+w2/AbJK7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerkeyloggerstealercollectionspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2